how do I log inbound traffic with a cisco 1721

We are getting an unusual amount of inbound traffic for about 7 hours per night and we would like to monitor where this traffic is coming from.  Is there a way to enable the 1721 to log the inbound traffic?
Who is Participating?
You can enable netflow on the interfaces

interface serial 0/0
  ip route-cache flow

interface fast 0/0
  ip route-cache flow

Examining the flows will show you source/destination IP addresses and ports.
Exporting the flow to something like NTOP will give you a tremendous amount of information:

Or you can enable ip accounting on the serial interface. This will also give you a lot of information with "show ip account"
you can also set an access control list on the external interface:

router#conf t
router(config)#access 100 permit tcp any any log
router(config)#access 100 permit udp any any log
router(config)#access 100 permit ip any any log
router(config)#int s0/0
router(config-int)#ip access group 100 in
router(config)#logging buffered
router(config)#buffer 4096
router#wr mem

you could then log back in and type "show log" to see the reslts.
If you really wanted to get special with it you could even restrict the time the access ist was active. Check Cisco's site for more in depth details.


It's unclear from your statement if the data is also hitting the LAN or if the router is unable to route the traffic and is therefore dropping it.  If you're not sure either, try:

config t
int (LAN)
ip accounting output-packets

then perform a 'show ip accounting' before and after the window.  You'll be able to see if the traffic is being requested or sent to one of your LAN devices.  If not, the router is dropping it and you'll need something else... like a firewall would really help.
I just realized this was for a 1721 (I was thinking 2500).  Sorry for the FW comment.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.